The deluge of fake bug reports is definitely something I should have noted as well, since that directly damages FOSS' capacity to find and fix bugs.
Baldur Bjanason has predicted that FOSS is at risk of being hit by "a vicious cycle leading to collapse", and security is a major part of his hypothesised cycle:
-
Declining surplus and burnout leads to maintainers increasingly stepping back from their projects.
-
Many of these projects either bitrot serious bugs or get taken over by malicious actors who are highly motivated because they can’t relay on pervasive memory bugs anymore for exploits.
-
OSS increasingly gets a reputation (deserved or not) for being unsafe and unreliable.
-
That decline in users leads to even more maintainers stepping back.